Starting an accounting business in Australia and your key legal obligations

Starting an accounting practice in Australia is as much a legal exercise as a technical one. Before you sign your first client, you take on a bundle of obligations that many new practitioners do not see coming: registration as a tax agent or BAS agent, written client and employment agreements that survive scrutiny under consumer law, privacy duties around the financial information you will hold, and, from 1 July 2026, anti-money laundering obligations that reach much further into accounting work than they do today.

This article sets out the obligations that apply to a new accounting business, who each one applies to, what you must actually do to comply, and what it costs to get it wrong. The duties below are the ones that shape every other decision you make in your first year: registration, client agreements, employee and contractor arrangements, privacy, financial services licensing, and AML/CTF.

Who these obligations apply to

Not every obligation hits every practice. Before you build your compliance stack, work out which duties your business actually triggers:

Tax agent registration: Anyone who provides tax agent services for a fee or reward must be a registered tax agent or BAS agent, and the registration rules apply from the day you start charging, not the day you open the door.
Client agreements: Every practice that issues standard form client agreements is caught by the unfair contract terms regime in the Australian Consumer Law (ACL), which carries penalties for businesses of any size.
Privacy: The Privacy Act 1988 (Cth) applies in full to businesses with annual turnover above $3 million. Smaller practices are generally exempt, but the exemption has holes, and it does not excuse you from handling tax file numbers and client financial data carelessly.
AFSL: You only need an Australian financial services licence if you provide financial services such as financial product advice. Standard tax compliance work does not trigger it, but some common add-ons, like recommending a self-managed super fund, come close.
AML/CTF: Today, only practices providing a narrow set of "designated services", such as managing client money, are captured. From 1 July 2026 that changes, and most accounting practices will need to work out whether the reforms apply to them.

Register with the Tax Practitioners Board before you take on clients

The Tax Agent Services Act 2009 (Cth) makes it an offence to provide tax agent services for a fee while unregistered. Registration is not a formality: it sits behind every tax return, BAS and piece of tax advice you will give, and the Tax Practitioners Board (TPB) is the regulator that grants and renews it.

The Act also sets out a Code of Professional Conduct covering honesty, competence, confidentiality, trust accounting and how you handle conflicts of interest. Your client agreements should reflect the code, particularly the confidentiality and conflict obligations, so both you and your clients know where the boundaries sit.

The consequences of skipping registration are concrete. Under s 50-5 of the Tax Agent Services Act 2009 (Cth), providing tax agent services while unregistered attracts a civil penalty of up to 250 penalty units for an individual, and 1,250 penalty units for a body corporate. Federal penalty units are currently $330, which puts the exposure at around $82,500 for an individual and $412,500 for a company. If you provide tax (financial) advice services, you must also be a registered tax agent or a qualified tax relevant provider, and advertising services you are not registered to provide is itself a separate contravention.

Make your client agreement work for you

Your client service agreement is the document that defines the commercial relationship, and it earns its keep in three places: scope, fees, and risk allocation.

Scope of services: Spell out what you will do, how often, and by when. "Monthly management accounts delivered by the 15th of the following month" works in a dispute; "regular reporting" does not. State plainly what is excluded, such as payroll processing, so a client cannot later claim a free add-on.
Fees and payment terms: Set out your rates, when invoices are due, what happens if a client does not pay, and what happens if the client provides incomplete or late information.
Change management: Require written approval and a separate quotation for work outside the original scope. This is the clause that stops scope creep becoming a fee dispute.

The trap here is the unfair contract terms regime. Since November 2023, proposing or relying on an unfair term in a standard form consumer or small business contract has been a contravention in its own right, not just a void term. Under s 23 and s 24 of the ACL (schedule 2 of the Competition and Consumer Act 2010 (Cth)), a term is unfair if it causes a significant imbalance in the parties' rights, is not reasonably necessary to protect your legitimate interests, and would cause detriment if relied on. Automatic fee increases, unilateral variation rights, and blanket exclusions of liability are the terms most likely to be challenged. The penalties under s 224 are up to $2.5 million for an individual and, for a body corporate, the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover.

Limitation of liability clauses are still worth having, but they must be drafted to survive. For services supplied to consumers, the ACL's consumer guarantees, including the guarantee of due care and skill, cannot be excluded, restricted or modified at all (s 64 of the ACL). For business clients, a cap set at a multiple of your fees, with a clear carve-out for conduct that cannot be limited, is far more defensible than a blanket exclusion. If you hold a CPA, CA or IPA public practice certificate, check whether your professional body participates in a Professional Standards Scheme; where it does, the scheme imposes a statutory cap on your civil liability, which changes how your liability clause should be written.

Sort out employee and contractor arrangements from day one

If you hire staff, the obligations start with the Fair Work Act 2009 (Cth). Written contracts must not undercut the National Employment Standards, including minimum wage, maximum weekly hours, leave entitlements and notice periods, and you need to check whether a modern award covers the work your employees do.

The bigger risk for accounting practices is classification. Bookkeepers and junior accountants are often engaged as independent contractors, and getting that wrong cuts both ways. Misrepresenting an employment relationship as contracting, sometimes called sham contracting, is prohibited, and the Fair Work Ombudsman actively pursues it. A genuine contractor relationship needs a written agreement that covers deliverables, payment schedules, intellectual property ownership, and who supplies the tools of the work. If the reality is that you control the hours, the work and the how, the label on the invoice will not save you.

Superannuation attaches to both sides of the line. The super guarantee rate is 12% for salary and wages paid from 1 July 2025, and from 1 July 2026 the new Payday Super rules require you to pay super each payday rather than quarterly. Contractors engaged wholly or principally for their labour can also attract super guarantee obligations, so a contractor agreement that assumes no super is payable needs to be checked against the actual arrangement, not the other way around.

Get on top of privacy before the first data breach

An accounting practice is a data business. You hold tax file numbers, bank details, salaries and super information for every client, and the privacy obligations attach to that information from the moment you collect it.

If your business has annual turnover above $3 million, you are an "organisation" under the Privacy Act 1988 (Cth) and must comply with the Australian Privacy Principles, including having a privacy policy, telling clients what you collect and why, and securing the information you hold. Smaller practices are generally exempt, but the exemption does not apply to every business, and the rules around tax file numbers apply to any practice that handles them.

The obligation most practices underrate is breach notification. Under Part IIIC of the Privacy Act 1988 (Cth), if you suspect an eligible data breach, you must assess it within 30 days, and if it is confirmed you must notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. For an accounting practice, a stolen laptop or a compromised email account can easily be an eligible data breach, and the clock starts when you become aware, not when you finish your investigation.

The penalties are real. A serious interference with privacy now carries a maximum civil penalty for a body corporate of the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover, and up to $2.5 million for an individual (s 13G of the Privacy Act 1988 (Cth)). Your client agreement and your software contracts should address how client data is handled, and if you use cloud platforms such as Xero, MYOB or QuickBooks, check what the provider's terms say about data ownership, security and breach notification, because a breach at the provider can still be your notification problem.

Check whether you need an AFSL to give financial advice

Standard accounting work, including tax compliance and tax advice, does not require an Australian financial services licence. The line gets crossed when you start giving financial product advice, which is a financial service under the Corporations Act 2001 (Cth). The classic example in an accounting practice is SMSF work: helping a client set up a self-managed super fund, or advising on contributions and investments inside it, can easily be financial product advice rather than tax advice.

If you provide financial product advice, you generally need an AFSL unless an exemption applies, and the exemptions are narrower than most practitioners assume. Where you do hold a licence, or rely on an exemption, your client agreements need to distinguish general information from personal advice, carry the required disclaimers, and reflect the disclosure obligations that come with the licence. Because the boundary between tax advice and financial advice is factual and case specific, this is one of the areas where a lawyer's assessment before you structure your service offering is cheaper than a regulator's assessment afterwards.

Prepare for AML/CTF now: the 1 July 2026 reforms

The anti-money laundering and counter-terrorism financing (AML/CTF) regime under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) has historically captured only a narrow slice of accounting work. Practices that provide "designated services", such as managing client assets or operating client bank and securities accounts, are already reporting entities with obligations to enrol with AUSTRAC, run an AML/CTF program, conduct customer due diligence, report suspicious matters and keep records.

That position changes materially on 1 July 2026. Under the tranche 2 reforms, AML/CTF obligations will apply to designated services commonly provided by accountants, alongside lawyers, conveyancers, real estate professionals and dealers in precious metals and stones. AUSTRAC opened enrolment for the newly regulated professions on 31 March 2026, and businesses that provide a designated service with a geographical link to Australia must enrol. For a new practice, the practical steps are to identify whether any service you offer is a designated service, enrol if it is, and build the AML/CTF program, customer identification and record-keeping processes into your client onboarding from the start rather than retrofitting them.

What it costs to get this wrong

The exposure is not theoretical, and it compounds across the regimes:

Registration: Up to $82,500 for an individual and $412,500 for a body corporate for providing tax agent services while unregistered.
Client agreements: Up to $2.5 million for an individual and the greater of $100 million, three times the benefit, or 30% of adjusted turnover for a body corporate for proposing or relying on unfair contract terms.
Privacy: Up to $2.5 million for an individual and the greater of $50 million, three times the benefit, or 30% of adjusted turnover for a body corporate for a serious interference with privacy.
Employment and super: Underpayment claims, Fair Work Ombudsman enforcement, and the super guarantee charge for missed or late super, plus legal costs and reputational damage that a small practice can rarely absorb.

None of this counts the civil exposure. A client dispute over scope, fees or a bad tax outcome will turn on the quality of your written agreement, and an unregistered or non-compliant practice defending a claim has a much weaker position than one that did the paperwork.

A first-year compliance checklist

Work through each of these items in your first year of operation:

Confirm your TPB registration (or BAS agent registration) is in place before you charge for your first service, and check the Code of Professional Conduct obligations.
Put a client service agreement in place that covers scope, fees, exclusions, change management and a defensible limitation of liability clause, and have it reviewed for unfair terms.
Classify every worker correctly, issue written employment or contractor agreements, and budget super at 12%, moving to payday payments from 1 July 2026.
Work out whether the Privacy Act applies to you, publish a privacy policy if it does, and document how you handle tax file numbers and client data.
Get a view on whether any service you offer crosses into financial product advice.
Assess your services against the AML/CTF designated services list, and enrol with AUSTRAC if you are captured, before 1 July 2026.

Where a lawyer actually helps

A commercial lawyer's role here is to map the obligations to your specific practice rather than hand you a template. An Artificer Legal practitioner would start by reviewing your service offering against the registration, AFSL and AML/CTF triggers, then draft or review your client agreement with the unfair contract terms regime and your limitation of liability in mind, then work through your worker arrangements and privacy documentation. The order matters: getting the scoping questions answered first means the documents are built for the obligations you actually have, not a generic version of them.

The deadline your new practice cannot afford to miss

If you take one thing from this article, make it the AML/CTF transition. Every other obligation in this article has been part of the accounting landscape for years, and most practitioners know, roughly, that they exist. The 1 July 2026 commencement of tranche 2, with enrolment already open through AUSTRAC, is different: it captures a profession that has never been regulated this way, and the practices that assume it does not apply to them will find out otherwise from a regulator rather than a lawyer. If you are starting a practice now, treat the AML/CTF scoping question as part of your business plan, alongside registration and your client agreement, and get a definitive answer on whether your services are designated services before you take on your first client.